New Relic: Permissions leaks the full name of other NR accounts - Regression of #267636

One more before I run to dinner... Steps to Reproduce: 1. Add a user to your account 1. Enter "123" as the name and "[email protected]" as the email 1. Make them a "user" base role. 1. Click add user button. 2. Navigate to https://synthetics.newrelic.com/accounts/1523936/permissions 3. Create a...

New Relic: [synthetics.newrelic.com] SMTP header injection leads to (mass) arbitrary email sending

While setting up a Synthetics "Ping", I noticed that the name of your monitor was echoed back in warning emails about hosts that fail the validation string phase. I abused this mechanism to insert newline mechanism in these emails, allowing the sending of near arbitrary emails to a easily...

New Relic: User is able to access and create private synthetics locations without upgrading (regression of #276157)

It seems like the fix done for 276157 wasn't enough, as I'm able to bypass it and generate private synthetics locations without approval or the proper plan. This is the page that users see when they navigate to the private synthetics location: F291890 I'm able bypass this by navigating as an Admi...

New Relic: Adding a new user discloses their full name in the "Users" section of NR Alerts notification channels page

The NR developers did a really good job at restricting me from finding out info about other user accounts through the NR Synthetics settings - so far I haven't found a way to bypass it yet 😉. There exists another way to obtain this information about other user accounts, and it has to do with the...

New Relic: [NR Synthetics] Restricted User can add/modify alert conditions on monitors without any synthetics privileges

There is a privilege escalation bug that allows a user with restricted privileges to make changes to alerts on Synthetics monitors, without the proper permissions to do so in fact, they can make changes with NO synthetics permissions. In order to reproduce this it's easiest if you have two accoun...

New Relic: Internal API endpoint discloses full account name of email address associated with unconfirmed user

There's an interesting thing happening with the Internal API call that lists users on an account. Based on what I can tell, it's another IDOR like █████████ in which it exposes user information of accounts that Steps to reproduce: 1. Create an account 2. As an admin, go to create a new user...

New Relic: Drupal admin takeover via install.php not being performed prior to install.

@grampae discovered an uninitialized Drupal instance running on one of our properties being hosted by a third party provider, an issue we've seen previously. To prevent this issue from surfacing again, we decommissioned the related domains and contacted the provider with details of the issue...

New Relic: [NR Alerts/Synthetics?] User with no Synthetics permissions can view synthetic monitor details through /internal_api/ endpoint

Hey all, This one is pretty interesting. What's happening is that a user with no permissions to view synthetics will get this page when they try to navigate directly to the Synthetics monitor list https://synthetics.newrelic.com/accounts/1523936/monitors: F267305 However, the restricted user can...

New Relic: Bypass of my three other reports #267636 + #255894 + #271861 - (IDOR) Ability to see full name associated with other New Relic accounts

@jonbottarini discovered a regression in the way users are shown within the Alerts notification UI. This allowed him to reveal the first and last name of an existing registered user if their email was known, rather than showing an obfuscated version of that information. The application protects...

New Relic: User to Admin privilege escalation in Infrastructure Conditions - /v2/accounts/1835740/alerts/conditions

Details The endpoints POST /v2/accounts/:accountid/alerts/conditions create new and PUT /v2/accounts/:accountid/alerts/conditions/:conditionid update existing on infrastructure-alert.service.newrelic.com are vulnerable to privilege escalation. As per the screenshot below, an account with regular...

GHSA-Q6CW-2553-7837 newrelic_rpm Gem Discloses Sensitive Information

Ruby agent 3.2.0 through 3.5.3.23 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information database credentials and SQL statements by sniffing the network and deserializing the data...

New Relic: Captcha Bypass on SignUp Form

The g-recaptcha-response parameter was not validated on the server side when submitting a form to the /signups endpoint. Any or no value could be provided for this parameter...

New Relic: Newrelic s3 bucket is writeable and deleteable by authorized AWS users

@kunalbahl discovered an open S3 bucket that appeared to belong to us. It was determined that this belonged to another company and this information was forwarded to Amazon for remediation...

New Relic: [NR Infrastructure] Bypass of #200576 through GraphQL query abuse - allows restricted user access to root account license key

@jonbottarini discovered an issue with our GraphQL implementation. This allowed a user without the proper authorization access to privileged account information on the same account. The writeup for this issue can read here: https://labs.detectify.com/2018/03/14/graphql-abuse/...

New Relic: Bypass of my two other reports #267636 + #255894 - (IDOR) Ability to see full name associated with other New Relic accounts

@jonbottarini discovered an issue where names associated with arbitrary existing email addresses can be revealed in the Alerts Notification Channel UI. As with similar previously-reported issues, this was resolved by obfuscating that information before it's presented...

New Relic: NR Internal_API call allows me to read the events/violations/policies/messages of ANY New Relic account (AND pull data from infrastructure)

@jonbottarini identified an issue with an API used to populate the UI across different products. This API wasn't properly validating the account ID for certain requests, returning information for any ID presented. I wrote up a quick overview about this issue here:...

New Relic .NET Agent SQL Injection Vulnerability

New Relic .NET Agent is a . A SQL injection vulnerability exists in New Relic .NET Agent versions prior to 6.3.123.0. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

New Relic: [NR Synthetics] (IDOR) Ability to see full name associated with other New Relic accounts through workaround of #255894

Did you think I had fallen of the earth? Fear not - for I have returned. In 255894 you fixed the issue where a person could mass-harvest names of other New Relic users through the user management section. A fix was quickly pushed for this, but now I've found a workaround. I'm reporting this on th...

Sql injection

New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLANALL ON protecti...

CVE-2017-9246

New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLANALL ON protecti...